Re: [Wrapper-user] Problem with RUN_AS_USER and nologin-shell

[Alexandre K. <ale...@ta...>]

Hi,

Thank you for your message.

On Mac OS X, we should not use "sudo" or "su" to interact with a daemon. We
should use "launchctl".
In the current version of the script file, we are correctly using
"launchctl" to install, start and remove the daemon.
Unfortunately, we are using "su - $RUN_AS_USER ..." to stop the daemon,
which is not correct.

In the next version of the Wrapper (3.5.26), we will fix this and use
"launchctl stop". By doing so, this will avoid the issue described by Opax.

If you have any comments or suggestions, please don't hesitate to contact
us via our mailing list or directly via our support email
su...@ta...

Regards,
Alexandre Klein


Alexandre Klein
Tanuki Software, Ltd.
6-16-7-1001 Nishi-Kasai, Edogawa-ku
Tokyo 134-0088 Japan
Tel: +81-3-3878-3211
Fax: +81-3-3878-0313
http://www.tanukisoftware.com

On Mon, Oct 20, 2014 at 5:38 AM, Dannes Wessels <da...@ex...> wrote:

> Hi,
>
> On 11 Oct 2014, at 0:27 , o....@we... wrote:
>
> I noticed that the checkUser function uses "su - $RUN_AS_USER -c ..." to
> switch to the target user. This fails if that user does not have a valid
> login shell, e.g. /bin/false or /usr/sbin/nologin. On the other hand, such
> "shells" are usually the default for daemon accounts in many UNIX systems.
> For GNU/Linux, this is easily fixed by using "su -s /bin/sh", overriding
> the user's default shell. Unfortunately, OS X's su does not have this
> option, so this is not a portable solution.
>
> The only portable way I found to circumvent the problem is to use "sudo -u
> $RUN_AS_USER ...", but I do not know whether this may cause problems on
> some systems/configurations.
>
> I think it would be nice to be able to use such restricted system accounts
> for Java services, so what do you think would be the best solution? Using
> the "-s" switch on systems that support it and ignore the problem on
> others? Or fall back to sudo on systems where the switch is missing?
>
>
> I can not think of a good work around either, I hope some one can…….
>
> regards
>
> Dannes
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> Wrapper-user mailing list
> Wra...@li...
> https://lists.sourceforge.net/lists/listinfo/wrapper-user
>
>